thumbgate 1.35.0 → 1.37.1

package/src/git-fast-cache.js

@@ -0,0 +1,220 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+
+/**
+ * GitFastCache — High-performance shadow git metadata cache.
+ * Inspired by Cursor's Continuity/Spokes architecture (Aug 2026).
+ *
+ * Replaces recurring synchronous git subprocess calls (git rev-parse, git status, git diff)
+ * during PreToolUse evaluation with mtime-invalidated in-memory cache lookups (<0.2ms).
+ */
+
+const FIXED_GIT_BIN_CANDIDATES = [
+  '/usr/bin/git',
+  '/opt/homebrew/bin/git',
+  '/usr/local/bin/git',
+];
+
+function canExecuteAbsoluteBinary(candidate) {
+  const normalized = String(candidate || '').trim();
+  if (!normalized || !normalized.includes(path.sep)) return false;
+  try {
+    fs.accessSync(normalized, fs.constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Resolve an absolute git binary path (no PATH-only spawn).
+ * Mirrors scripts/operational-integrity.js resolveGitBinary fixed-candidate pattern.
+ * @param {Object} [options]
+ * @returns {string|null}
+ */
+function resolveGitBinary(options = {}) {
+  const env = options.env || process.env;
+  const candidates = Array.isArray(options.candidates) && options.candidates.length > 0
+    ? options.candidates
+    : [env.THUMBGATE_GIT_BIN, ...FIXED_GIT_BIN_CANDIDATES];
+
+  for (const candidate of candidates) {
+    if (!canExecuteAbsoluteBinary(candidate)) continue;
+    return String(candidate).trim();
+  }
+
+  return null;
+}
+
+const GIT_BIN = resolveGitBinary();
+
+class GitFastCache {
+  constructor(options = {}) {
+    this.ttlMs = options.ttlMs || 3000;
+    this.cache = new Map(); // repoRoot -> CachedRepoState
+    this.gitBin = options.gitBin || GIT_BIN;
+  }
+
+  execGit(args, cwd) {
+    if (!this.gitBin) {
+      throw new Error('Git executable is unavailable in this runtime');
+    }
+    return execFileSync(this.gitBin, args, {
+      cwd,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+  }
+
+  findRepoRoot(startDir = process.cwd()) {
+    let current = path.resolve(startDir);
+    try {
+      current = fs.realpathSync(current);
+    } catch {
+      // fallback
+    }
+    while (current !== path.dirname(current)) {
+      const gitDir = path.join(current, '.git');
+      if (fs.existsSync(gitDir)) {
+        return current;
+      }
+      current = path.dirname(current);
+    }
+    return null;
+  }
+
+  getGitMetaDir(repoRoot) {
+    const gitPath = path.join(repoRoot, '.git');
+    if (!fs.existsSync(gitPath)) return null;
+
+    try {
+      const stat = fs.statSync(gitPath);
+      if (stat.isDirectory()) return fs.realpathSync(gitPath);
+      if (stat.isFile()) {
+        // Handle git worktree pointer file: "gitdir: /path/to/worktree"
+        const content = fs.readFileSync(gitPath, 'utf8').trim();
+        const match = /^gitdir:\s*(.+)$/i.exec(content);
+        if (match?.[1]) {
+          return fs.realpathSync(path.resolve(repoRoot, match[1].trim()));
+        }
+      }
+    } catch {
+      return null;
+    }
+    return null;
+  }
+
+  getCacheFingerprint(gitDir) {
+    if (!gitDir || !fs.existsSync(gitDir)) return 'empty';
+    try {
+      const headFile = path.join(gitDir, 'HEAD');
+      const indexFile = path.join(gitDir, 'index');
+      const headMtime = fs.existsSync(headFile) ? fs.statSync(headFile).mtimeMs : 0;
+      const indexMtime = fs.existsSync(indexFile) ? fs.statSync(indexFile).mtimeMs : 0;
+      return `${headMtime}:${indexMtime}`;
+    } catch {
+      return 'unknown';
+    }
+  }
+
+  getRepoState(targetDir = process.cwd()) {
+    const repoRoot = this.findRepoRoot(targetDir);
+    if (!repoRoot) {
+      return {
+        isGitRepo: false,
+        repoRoot: null,
+        branch: null,
+        headSha: null,
+        isDirty: false,
+        stagedFiles: [],
+        lookupTimeMs: 0,
+      };
+    }
+
+    const start = process.hrtime.bigint();
+    const gitDir = this.getGitMetaDir(repoRoot);
+    const fingerprint = this.getCacheFingerprint(gitDir);
+    const now = Date.now();
+
+    const cached = this.cache.get(repoRoot);
+    if (cached && cached.fingerprint === fingerprint && (now - cached.cachedAt) < this.ttlMs) {
+      const durationMs = Number(process.hrtime.bigint() - start) / 1e6;
+      return { ...cached.state, lookupTimeMs: durationMs, cached: true };
+    }
+
+    // Refresh state from git inspection
+    let branch = 'unknown';
+    let headSha = null;
+
+    if (gitDir) {
+      try {
+        const headContent = fs.readFileSync(path.join(gitDir, 'HEAD'), 'utf8').trim();
+        if (headContent.startsWith('ref: refs/heads/')) {
+          branch = headContent.replace('ref: refs/heads/', '');
+          const refFile = path.join(gitDir, 'refs', 'heads', branch);
+          if (fs.existsSync(refFile)) {
+            headSha = fs.readFileSync(refFile, 'utf8').trim();
+          }
+        } else {
+          headSha = headContent;
+        }
+      } catch {
+        // fallback
+      }
+    }
+
+    if (!headSha) {
+      try {
+        headSha = this.execGit(['rev-parse', 'HEAD'], repoRoot).trim();
+      } catch {
+        headSha = null;
+      }
+    }
+
+    let stagedFiles = [];
+    let isDirty = false;
+    try {
+      const stagedOut = this.execGit(['diff', '--cached', '--name-only'], repoRoot);
+      stagedFiles = stagedOut.split('\n').map((s) => s.trim()).filter(Boolean);
+      const statusOut = this.execGit(['status', '--porcelain'], repoRoot);
+      isDirty = statusOut.trim().length > 0;
+    } catch {
+      // fallback
+    }
+
+    const state = {
+      isGitRepo: true,
+      repoRoot,
+      branch,
+      headSha,
+      isDirty,
+      stagedFiles,
+    };
+
+    const finalFingerprint = this.getCacheFingerprint(gitDir);
+    this.cache.set(repoRoot, {
+      fingerprint: finalFingerprint,
+      cachedAt: now,
+      state,
+    });
+
+    const durationMs = Number(process.hrtime.bigint() - start) / 1e6;
+    return { ...state, lookupTimeMs: durationMs, cached: false };
+  }
+
+  clear() {
+    this.cache.clear();
+  }
+}
+
+const defaultCache = new GitFastCache();
+
+module.exports = {
+  GitFastCache,
+  defaultCache,
+  resolveGitBinary,
+  FIXED_GIT_BIN_CANDIDATES,
+};

package/src/git-wal-sync.js

@@ -0,0 +1,156 @@
+/**
+ * Write-Ahead Log (WAL) & Optimistic Concurrency Engine for Git Mutations
+ *
+ * Inspired by Cursor Continuity's WAL-first architecture (https://cursor.com/blog/git-at-any-scale).
+ * Provides an append-only, tamper-evident WAL and atomic Compare-And-Swap (CAS) index
+ * to prevent multi-agent race conditions during file mutations and tool calls.
+ *
+ * @module git-wal-sync
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+
+/**
+ * Computes a SHA-256 digest of mutation payload.
+ *
+ * @param {object} payload - Mutation data
+ * @returns {string} Hex SHA-256
+ */
+function computeChecksum(payload) {
+  return crypto.createHash('sha256').update(JSON.stringify(payload)).digest('hex');
+}
+
+/**
+ * Initializes a WAL session directory for a repository.
+ *
+ * @param {string} repoRoot - Path to repository root
+ * @returns {object} WAL session metadata
+ */
+function initWalSession(repoRoot) {
+  const walDir = path.join(repoRoot, '.thumbgate', 'wal');
+  fs.mkdirSync(walDir, { recursive: true });
+
+  const indexPath = path.join(walDir, 'gitwal-index.json');
+  let index = { seq: 0, etag: 'e0', lastUpdated: Date.now() };
+
+  if (fs.existsSync(indexPath)) {
+    try {
+      index = JSON.parse(fs.readFileSync(indexPath, 'utf8'));
+    } catch {
+      index = { seq: 0, etag: 'e0', lastUpdated: Date.now() };
+    }
+  } else {
+    fs.writeFileSync(indexPath, JSON.stringify(index, null, 2), 'utf8');
+  }
+
+  return {
+    repoRoot,
+    walDir,
+    indexPath,
+    index,
+  };
+}
+
+/**
+ * Appends an immutable WAL entry to the log.
+ *
+ * @param {object} walSession - Active WAL session
+ * @param {object} mutation - Proposed tool mutation (toolName, filePath, diff, etc.)
+ * @returns {object} Appended entry with assigned sequence number and checksum
+ */
+function appendWalEntry(walSession, mutation) {
+  const seq = (walSession.index.seq || 0) + 1;
+  const entry = {
+    seq,
+    timestamp: Date.now(),
+    toolName: mutation.toolName || 'unknown',
+    filePath: mutation.filePath || null,
+    operation: mutation.operation || 'modify',
+    payloadChecksum: computeChecksum(mutation),
+    actor: mutation.actor || process.env.THUMBGATE_SESSION_AGENT || 'local-agent',
+  };
+
+  const entryFile = path.join(walSession.walDir, `entry-${String(seq).padStart(6, '0')}.wal.json`);
+  fs.writeFileSync(entryFile, JSON.stringify(entry, null, 2), 'utf8');
+
+  return entry;
+}
+
+/**
+ * Performs an atomic Compare-And-Swap (CAS) commit of the WAL index.
+ *
+ * @param {object} walSession - Active WAL session
+ * @param {number} expectedSeq - Expected prior sequence number
+ * @param {object} newEntry - The newly appended WAL entry
+ * @returns {{ ok: boolean, currentSeq: number, etag: string, error?: string }}
+ */
+function casCommitIndex(walSession, expectedSeq, newEntry) {
+  let currentIndex = { seq: 0, etag: 'e0' };
+  if (fs.existsSync(walSession.indexPath)) {
+    try {
+      currentIndex = JSON.parse(fs.readFileSync(walSession.indexPath, 'utf8'));
+    } catch {
+      currentIndex = { seq: 0, etag: 'e0' };
+    }
+  }
+
+  if (currentIndex.seq !== expectedSeq) {
+    return {
+      ok: false,
+      currentSeq: currentIndex.seq,
+      etag: currentIndex.etag,
+      error: `CAS Precondition Failed: expected seq ${expectedSeq} but found ${currentIndex.seq}`,
+    };
+  }
+
+  const updatedIndex = {
+    seq: newEntry.seq,
+    etag: `e${newEntry.seq}`,
+    lastUpdated: Date.now(),
+    lastChecksum: newEntry.payloadChecksum,
+  };
+
+  fs.writeFileSync(walSession.indexPath, JSON.stringify(updatedIndex, null, 2), 'utf8');
+  walSession.index = updatedIndex;
+
+  return {
+    ok: true,
+    currentSeq: updatedIndex.seq,
+    etag: updatedIndex.etag,
+  };
+}
+
+/**
+ * Reads all WAL entries up to the current sequence number.
+ *
+ * @param {object} walSession - Active WAL session
+ * @returns {object[]} List of valid WAL entries
+ */
+function readWalEntries(walSession) {
+  if (!fs.existsSync(walSession.walDir)) return [];
+
+  const files = fs.readdirSync(walSession.walDir)
+    .filter((f) => f.startsWith('entry-') && f.endsWith('.wal.json'))
+    .sort((a, b) => a.localeCompare(b));
+
+  const entries = [];
+  for (const f of files) {
+    try {
+      const content = fs.readFileSync(path.join(walSession.walDir, f), 'utf8');
+      entries.push(JSON.parse(content));
+    } catch {
+      // skip corrupted entries
+    }
+  }
+  return entries;
+}
+
+module.exports = {
+  computeChecksum,
+  initWalSession,
+  appendWalEntry,
+  casCommitIndex,
+  readWalEntries,
+};

package/src/hash-anchored-edit.js

@@ -0,0 +1,82 @@
+'use strict';
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+
+/**
+ * HashAnchoredEditGuard — Pre-edit concurrency & content collision guard.
+ * Inspired by Dirac's Hash-Anchored Edit Engine (Aug 2026).
+ *
+ * Prevents race condition regressions where concurrent agent sessions or human operators
+ * modify code lines while an agent is generating an edit.
+ */
+
+function computeChunkHash(content) {
+  return crypto.createHash('sha256').update(String(content || '')).digest('hex').slice(0, 16);
+}
+
+function evaluateHashAnchoredEdit(request = {}) {
+  const { filePath, targetContent, expectedHash, startLine, endLine } = request;
+
+  if (!filePath || !fs.existsSync(filePath)) {
+    return {
+      allowed: false,
+      reason: 'target_file_not_found',
+      message: `File does not exist: ${filePath}`,
+    };
+  }
+
+  let fileContent = '';
+  try {
+    fileContent = fs.readFileSync(filePath, 'utf8');
+  } catch (err) {
+    return {
+      allowed: false,
+      reason: 'file_read_error',
+      message: `Failed to read ${filePath}: ${err.message}`,
+    };
+  }
+
+  const lines = fileContent.split('\n');
+  let currentSlice = '';
+
+  if (typeof startLine === 'number' && typeof endLine === 'number' && startLine >= 1 && endLine <= lines.length) {
+    currentSlice = lines.slice(startLine - 1, endLine).join('\n');
+  } else if (targetContent) {
+    // Exact target content search
+    if (!fileContent.includes(targetContent)) {
+      return {
+        allowed: false,
+        reason: 'target_content_drift',
+        message: `Target code block was modified or does not match current file contents.`,
+        currentFileHash: computeChunkHash(fileContent),
+      };
+    }
+    currentSlice = targetContent;
+  }
+
+  const actualHash = computeChunkHash(currentSlice);
+
+  if (expectedHash && expectedHash !== actualHash) {
+    return {
+      allowed: false,
+      reason: 'hash_anchor_mismatch',
+      message: `Hash anchor drift detected: expected ${expectedHash}, found ${actualHash}. Another session or user modified this region.`,
+      expectedHash,
+      actualHash,
+    };
+  }
+
+  return {
+    allowed: true,
+    reason: 'anchor_verified',
+    chunkHash: actualHash,
+    lineCount: lines.length,
+    timestamp: new Date().toISOString(),
+  };
+}
+
+module.exports = {
+  computeChunkHash,
+  evaluateHashAnchoredEdit,
+};